Assuming that person may leak the APK to another person with security expertise (and even tell the password), how do I ensure the app is made (practically) inaccessible to anyone but that person?

  • 4
    Not through technical means. Maybe try legal ones. Commented Oct 7, 2016 at 18:30

2 Answers 2


You could use multiple checks on the device itself to verify that the apk has not been shared (IMEI, android id, phone number, etc). This will likely only serve to slow the other person "with security expertise" from gaining access. Given the right level of knowledge, skill, time and determination, a clever individual can spoof all of these identifying properties.

It all depends on how badly you care that someone else may get their hands on it.

  • 1
    Can't believe I didn't think of device IMEI. Thanks!
    – geft
    Commented Oct 8, 2016 at 3:39
  • 1
    is device IMEI really a good idea? The app then only works for one device, while your question was how to make it accessible for one person.
    – Lukas
    Commented Oct 8, 2016 at 10:21
  • More importantly, the person obtaining the apk can just change the source code and remove all the checks or replace the values. Reversing an apk and changing it is relatively easy. I really don't think that securing the app only on the client side is possible if the respective checks are not enforced server-side as well.
    – Denis
    Commented Jun 13, 2019 at 6:15

You can limit entry by adding in a login page with Google Or Facebook Oauth. And only allow entry with certain email addresses.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .